20 months - 18 years
Enrol with ease
Discover us & the campus
Where confidence grows
Discover what's happening
The Privacy Policy forms part of the General Conditions governing this website.
SEPTEMBER 2026 VERSION
In accordance with applicable data protection regulations (Regulation (EU) 679/2016, General Data Protection Regulation, and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights), you are informed as follows:
Who is the controller of the data processing?
All the data provided by Users in the different forms, requests for information, registration, to contact you or to provide us with your Curriculum will be incorporated and processed, both through telematic, computerised and non-automated means, being the party responsible for such processing:
BRITISH&INTERNATIONAL SCHOOL XXI, S.L.
Calle Padre Dominicos 1; 28050 Madrid.
CIF/NIF B86846425
Phone: 686 090 053
Email of the Data Protection Officer: dpo.external@ispschools.com
Who can provide us with data?
Access by Users to the websites
may involve the processing of personal data. By accessing our website, you declare that you are of legal age and that all the data you provide us with, whether they are obligatory in order to provide you with the service or information or additional data that complete your information and request, are true and correct. You provide this information voluntarily.
For certain data processing, we will ask you to grant us your consent and for certain purposes, we will ask for your authorisation by activating the specific validation boxes.
What data do we collect?
If you visit the website, we may process your IP address, the operating system or browser you use, and even the duration of your visit, on an anonymous basis. If you provide us with data through the contact form, we will process your identification data and any data you share with us in the form in order to contact you through the means provided, such as email, telephone calls or WhatsApp.
For what purposes will we process your personal data?
To manage the requested service, respond to your request or process your application.
What is the legal basis for the processing of your data?
The consent of the user or the existence of a contractual relationship between the parties.
For how long will we keep your personal data?
For as long as you remain linked to us or until you exercise a right that entails the deletion of your data.
What data do we process?
We may process your identification, contact and academic data, information relating to permissions, grades, etc., all depending on your user profile (student, parent, guardian, teacher, etc.)
For what purposes?
The data included in the educational platforms will be processed by the Controller for the purpose of managing the relationship the School has with each User, depending on their profile.
What is the legal basis?
The existence of a contractual relationship between the parties.
For how long will we keep the data?
For the duration of the contractual relationship and, once it has ended, for the legal limitation periods established for the exercise of legal actions.
We will process your identification data and the data you share with us within the framework of the relevant social network.
To manage the requested service, respond to your requests, or process your applications. To create, foster and maintain a community of followers within the social network.
The consent of the user or the existence of a contractual relationship between the parties. In this case, the processing is based on acceptance of a contractual relationship within the environment of the relevant social network, and in accordance with its Privacy Policies, so it is advisable for the user to consult them. The controller may only consult or unsubscribe data in a restricted manner, as it has a specific profile. This data will be processed for as long as the user allows through the various interactions that each social network permits. Any rectification of data or restriction of information or posts must be carried out by the user through their profile settings on the social network itself.
The controller will collect data from candidates through its employment portal accessible from its website. It will process the identification, contact, academic and professional data that the candidate includes when submitting their application.
What is the legal basis for the processing?
The legal basis for the processing described is the existence of a pre-contractual relationship between the parties.
For how long will we keep your data?
One year after receipt of a curriculum vitae, the controller will proceed to its secure destruction.
The data you share with us in your report and, should you decide not to make an anonymous report, your identification and contact data.
The personal data collected through the information channel is processed for the sole purpose of processing the communications or information received, sending the reporting person the relevant communications on the status of processing or the results thereof, unless they have objected to this; and, where appropriate, carrying out all actions aimed at verifying the plausibility of the facts reported in order to determine whether to close the file, adopt the relevant measures, or refer it to the competent authority in each case.
Compliance with a legal obligation.
All personal data that may have been communicated and that relate to conduct not covered by the scope of the law will be deleted immediately. If the information received contains personal data included within special categories of data, it will be deleted immediately, without being recorded or processed, as will any information provided, or part of it, in the event that it is shown not to be truthful, from the moment such circumstance becomes known, unless such lack of truthfulness may constitute a criminal offence, in which case the information will be kept for as long as necessary while the judicial proceedings are ongoing.
Data that is processed is kept in the information system only for the time strictly necessary to decide on the appropriateness of initiating an investigation into the reported facts. This period may not exceed three months from receipt of the information, unless, due to its particular complexity, the period has been extended by a further three months. Communications that have not been acted upon are kept in anonymised form. Where it is agreed to initiate the relevant investigation, the data will be processed for as long as the investigation lasts. A register of information is kept available to the competent judicial authorities in accordance with the requirements and limits established in Law 2/2023. Under no circumstances will data be kept for a period exceeding ten years.
We will process your identification data and, should a potential threat be detected, the data captured by the application.
To safeguard the moral integrity of students and to enforce the ethos of Colegios Laude S.L.U.
For staff, the existence of a contractual relationship between the parties, understood within the framework of the employer's management powers established under the Workers' Statute, and for students, the public interest in guaranteeing the best interests of the minor.
For as long as the investigation into the potential threat is being processed.
Processing of third parties' data.
As a general rule, the Controller will only process data provided by the data subjects themselves. Should it receive data from third parties, it must first inform such persons and request their consent, or otherwise Colegios Laude, S.L.U. shall be exempt from any liability for failure to comply with this requirement.
Commercial communications by electronic means
Should the user have previously given their express consent to this, or where this is covered by the controller's legitimate interest, communications of interest will be sent to the email address provided.
Security measures
Colegios Laude, S.L.U. places great importance on the security of all personally identifiable information and has adopted an optimal level of security, putting in place the resources and adopting the technical and organisational measures appropriate to the state of the art in technology to prevent the loss, misuse, alteration, unauthorised access to, or theft of personal data. For example, our security and privacy policies are reviewed periodically and improved as necessary, and only authorised staff have access to user information. At Colegios Laude, S.L.U. we make efforts and dedicate resources to improving our pages and their functionalities every day so that users can browse safely.
Disclosure to third parties
Users' personal data may be disclosed to:
International transfers
Colegios Laude, S.L.U. is part of International School Partnership Ltd, an international education group headquartered in the United Kingdom. For this reason, data transfers to the United Kingdom will take place, carried out under the European Commission's Adequacy Decision, which recognises that the United Kingdom ensures a level of data protection equivalent to that required under European regulations.
Additionally, the use of certain digital tools and platforms necessary for the provision of the service may involve your data being processed outside the European Economic Area (EEA). Where this occurs, such transfers will always be carried out ensuring an adequate level of protection, through the mechanisms provided for under European data protection regulations (such as the Standard Contractual Clauses approved by the European Commission or other equivalent safeguards recognised by the General Data Protection Regulation), so that your rights and freedoms remain protected regardless of the country in which the data is located.
User rights
Data protection regulations grant the user a series of rights, which must be honoured by the Controller:
To facilitate this process, and in compliance with the principle of data accuracy, if any data is amended, the Controller would appreciate being informed of such amendment.
To exercise the aforementioned rights, the user may request a form from the controller, or use those prepared by the Spanish Data Protection Agency or third parties. Forms may be submitted in person, sent by post, or by email to the address of the Data Protection Officer: dpo.external@ispschools.com
Depending on the right exercised, the Controller will take a maximum of one month to respond from receipt of the request, and two months if the matter is highly complex, in which case the user will be notified.
In addition, we inform you that you may always turn to the Spanish Data Protection Agency (www.aepd.es) to request its protection or to lodge a complaint in relation to the processing of personal data.
Cookies
The Website uses Cookies. If you wish to obtain further information, you may do so by accessing our Cookies Policy.
Changes to the Privacy Policy
The Controller may modify or adapt the Privacy Policy and the Processing of Personal Data, so we recommend that you check it periodically to stay up to date.
